Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hva8-kb62-rkax
Vulnerability ID VCID-hva8-kb62-rkax
Aliases CVE-2024-39205
GHSA-r9pp-r4xf-597r
Summary Duplicate This advisory duplicates another.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.83924 https://api.first.org/data/v1/epss?cve=CVE-2024-39205
cvssv3.1 9.8 https://github.com/advisories/GHSA-h95x-26f3-88hr
cvssv4 9.3 https://github.com/advisories/GHSA-h95x-26f3-88hr
generic_textual CRITICAL https://github.com/advisories/GHSA-h95x-26f3-88hr
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-r9pp-r4xf-597r
cvssv3.1 9.8 https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
cvssv4 9.3 https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
generic_textual CRITICAL https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
cvssv3.1 9.8 https://github.com/Marven11/CVE-2024-39205-Pyload-RCE/tree/main
ssvc Track* https://github.com/Marven11/CVE-2024-39205-Pyload-RCE/tree/main
cvssv3.1 9.8 https://github.com/pyload/pyload
cvssv4 9.3 https://github.com/pyload/pyload
generic_textual CRITICAL https://github.com/pyload/pyload
ssvc Track* https://github.com/pyload/pyload
cvssv3.1 9.8 https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
cvssv3.1_qr CRITICAL https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
cvssv4 9.3 https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
generic_textual CRITICAL https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
ssvc Track* https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2024-39205
cvssv4 9.3 https://nvd.nist.gov/vuln/detail/CVE-2024-39205
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2024-39205
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-39205
https://github.com/pyload/pyload
CVE-2024-28397-JS2PY-SANDBOX-ESCAPE https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
CVE-2024-39205 https://nvd.nist.gov/vuln/detail/CVE-2024-39205
GHSA-h95x-26f3-88hr https://github.com/advisories/GHSA-h95x-26f3-88hr
GHSA-r9pp-r4xf-597r https://github.com/advisories/GHSA-r9pp-r4xf-597r
GHSA-r9pp-r4xf-597r https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
Data source Metasploit
Description CVE-2024-28397 is sandbox escape in js2py (<=0.74) which is a popular python package that can evaluate javascript code inside a python interpreter. The vulnerability allows for an attacker to obtain a reference to a python object in the js2py environment enabling them to escape the sandbox, bypass pyimport restrictions and execute arbitrary commands on the host. At the time of writing no patch has been released, version 0.74 is the latest version of js2py which was released Nov 6, 2022. CVE-2024-39205 is an remote code execution vulnerability in Pyload (<=0.5.0b3.dev85) which is an open-source download manager designed to automate file downloads from various online sources. Pyload is vulnerable because it exposes the vulnerable js2py functionality mentioned above on the /flash/addcrypted2 API endpoint. This endpoint was designed to only accept connections from localhost but by manipulating the HOST header we can bypass this restriction in order to access the API to achieve unauth RCE.
Note 
Stability:
  - crash-safe
Reliability:
  - repeatable-session
SideEffects:
  - ioc-in-logs
  - artifacts-on-disk
Ransomware campaign use Unknown
Source publication date Oct. 28, 2024
Platform Linux,Unix
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/pyload_js2py_cve_2024_39205.rb
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-h95x-26f3-88hr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/advisories/GHSA-h95x-26f3-88hr
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/Marven11/CVE-2024-39205-Pyload-RCE/tree/main
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-30T20:48:52Z/ Found at https://github.com/Marven11/CVE-2024-39205-Pyload-RCE/tree/main
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pyload/pyload
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/pyload/pyload
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-30T20:48:52Z/ Found at https://github.com/pyload/pyload
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-30T20:48:52Z/ Found at https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-39205
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-39205
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99313
EPSS Score 0.83924
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:22:14.649079+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/pyload-ng/GHSA-r9pp-r4xf-597r.yml 38.6.0